CVE-2025-67599

Executive Summary

CVE-2025-67599 is a Missing Authorization vulnerability in the WebToffee eCommerce Marketing Automation plugin for WordPress (specifically the decorator-woocommerce-email-customizer component). This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to sensitive marketing automation data. The vulnerability affects all versions from n/a through 2.1.1. As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin’s update channel and apply any security patches immediately upon release. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no additional supply chain analysis is required.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low confidentiality loss. No integrity or availability impact is expected.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the decorator-woocommerce-email-customizer component of the WebToffee eCommerce Marketing Automation plugin. This component is responsible for customizing WooCommerce transactional emails. The plugin fails to properly verify user permissions before allowing access to certain administrative functions or data endpoints.

An attacker can send crafted HTTP requests to the vulnerable endpoint(s) without any authentication. Because the access control is incorrectly configured, the server processes the request and returns sensitive information, such as email templates, customer data, or marketing automation configurations. The exact endpoint(s) affected are not publicly disclosed, but the vulnerability is present in all versions up to and including 2.1.1.

The root cause is likely a missing current_user_can() check or improper capability validation in one or more AJAX handlers or REST API routes. This is a common pattern in WordPress plugins where developers assume that only authenticated users will access certain endpoints, but fail to enforce that assumption.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison cannot be provided. However, based on the vulnerability type, the following is a typical vulnerable pattern and its patched counterpart:

Vulnerable Code (PHP):

add_action('wp_ajax_webtoffee_get_email_data', 'webtoffee_get_email_data');
add_action('wp_ajax_nopriv_webtoffee_get_email_data', 'webtoffee_get_email_data'); // Missing capability check

function webtoffee_get_email_data() {
    // Process request and return sensitive data
    $data = get_option('webtoffee_email_templates');
    wp_send_json_success($data);
}

Patched Code (PHP):

add_action('wp_ajax_webtoffee_get_email_data', 'webtoffee_get_email_data');
// Remove the nopriv hook to require authentication

function webtoffee_get_email_data() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('webtoffee_email_templates');
    wp_send_json_success($data);
}

The patched version removes the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adds a current_user_can('manage_options') check to ensure only administrators can access the data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WebToffee eCommerce Marketing Automation plugin version <= 2.1.1 installed and activated.
• Network access to the target site.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include /wp-admin/admin-ajax.php with an action parameter like webtoffee_get_email_data or similar.
2. Send a crafted HTTP request without any authentication cookies:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=webtoffee_get_email_data"
   

3. If the endpoint is vulnerable, the server will return sensitive data (e.g., email templates, customer lists) in JSON format.

Expected Output:

{
    "success": true,
    "data": {
        "templates": [
            {"id": 1, "name": "Order Confirmation", "content": "..."},
            {"id": 2, "name": "Shipping Update", "content": "..."}
        ]
    }
}

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action parameters that do not include a valid nonce or authentication cookie.
• Look for repeated requests from the same IP to multiple AJAX actions in a short period.
• Check server logs for 200 responses to AJAX requests that should require authentication.

Defense:

• Immediately update the plugin to a patched version once available.
• If no patch is available, consider disabling the plugin or implementing a Web Application Firewall (WAF) rule to block unauthenticated access to known vulnerable endpoints.
• Use a WordPress security plugin to enforce capability checks on all AJAX handlers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters like webtoffee_get_email_data (or similar) without a valid X-WP-Nonce header or authentication cookie.
  • Unusual outbound data transfers from the WordPress server containing JSON with email template content.

• File IOCs:

  • Modified or suspicious files in /wp-content/plugins/webtoffee-ecommerce-marketing-automation/ directory.
  • Unexpected log entries in /wp-content/debug.log indicating failed capability checks.

• Behavioral IOCs:

  • Unauthorized access to email template customization features.
  • Sudden changes to WooCommerce email templates without admin action.

Detection Engineering

YARA Rule

rule Detect_WebToffee_Missing_Auth_CVE_2025_67599 {
    meta:
        description = "Detects exploitation attempts for CVE-2025-67599 in WebToffee eCommerce Marketing Automation plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67599"
        hash = "unknown"
    strings:
        $ajax_action = "webtoffee_get_email_data" nocase
        $ajax_url = "/wp-admin/admin-ajax.php" nocase
        $sensitive_data = "email_templates" nocase
    condition:
        all of them
}

Sigma Rule

title: WebToffee Missing Authorization Exploitation Attempt
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP POST requests to WordPress admin-ajax.php with WebToffee action parameters without authentication
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67599
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=webtoffee_
    condition: selection
falsepositives:
    - Legitimate admin actions with proper authentication
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67599 WebToffee Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=webtoffee_"; http_client_body; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations until a patch is released.
2. Implement a WAF rule to block unauthenticated POST requests to /wp-admin/admin-ajax.php with action parameters starting with webtoffee_.
3. Monitor logs for any signs of exploitation (see IOCs section).

Long-Term Fix:

• Apply the official patch from WebToffee once released.
• If no patch is forthcoming, consider replacing the plugin with an alternative that provides similar functionality with proper security controls.
• Conduct a security audit of all WordPress plugins to ensure proper capability checks are in place.

Workaround:

• Add the following code to the theme's functions.php file to block unauthenticated access to the vulnerable endpoint:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'webtoffee_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers